Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698943332439.pdf (South Africa)
INFORMATION MEMORANDUM TO : Mogokare Richard Seleke DIRECTOR-GENERAL FROM : Justin De Allende PLO RE DATE : : PARLIAMENTARY QUESTION NO 92 26 May 2017 ================================================================ To provide the Minister with a response to Parliamentary Question Number 92 COVER MEMO AND THE PACKAGING OF PQ BY: Department of Public Enterprises COMMENTS: ……………………………….

Act.
Act.

DDG: TE Date: ………………………………… Mogokare Richard Seleke Director-General Date: ……………………………………….. APPROVED/DECLINED/COMMENTS ………………………………………….. ………………………………………….. ………………………………………….

1 DEPARTMENT: PUBLIC ENTERPRISES REPUBLIC OF SOUTH AFRICA NATIONAL ASSEMBLY QUESTION FOR WRITTEN REPLY QUESTION NO.

: 92 DATE OF PUBLICATION: 19 MAY 2017 92.
Mr G Michalakis (Free State: DA) to ask the Minister of Public Enterprises: (1) How much has been spent on the (a) prevention of cyber-attacks and (b) investment into cyber security in respect of state-owned enterprises (SOEs) in the (i) 2012/13, (ii) 2013/14, (iii) 2014/15, (iv) 2015/16 and (v) 2016/17 financial years; (2) Whether her department has (a) an internal policy and (b) any employee awareness programmes on cyber security; if not, why not; if so, what are the relevant details; (3) Whether any professional assistance has been required regarding cyber security issues; if not, what is the position in this regard; if so, what are the relevant details; (4) Whether a permanent cyber security expert with the aim to prevent cyber- attacks has been employed; if not, why not; if so, when; 2 (5) Whether any SOEs have been subjected to any cyber security attacks in the (a) 2012/13, (b) 2013/14, (c) 2014/15, (d) 2015/16 and (e) 2016/17 financial years; if so, what (i) costs and (ii) risks were involved?
CW183E Reply: DEPARTMENT (1) (a-b) (I, ii, iii, iv,v) None (2) The department has a comprehensive information security policy which covers all aspects of information security.

Information on emerging cyber threats and internal routinely disseminated communication.

to staff via trends is (3) As part of the current IT strategy, the department is in the processes of appointing a service provider to assist with enhancing of the current information security programmes and controls within the department.
(4) The department does not have a permanent cyber security expert, but routinely utilizes the expertise of the South African State Security agency (SSA) and other partners to conduct network vulnerability assessment, following which the IT staff will apply the necessary remediation.
(5) None ALEXKOR SOC LIMITED (INCLUDING HEAD OFFICE AND ALEXANDER BAY OPERATIONS (1) (a) (b) (i) (ii) (iii) (iv) (v) (i) (ii) (iii) 2012/13 = R180 584 2013/14 = R106 906 2014/15 = R 81 781 2015/16 = R 92406 2016/17 = R 98 628 2012/13 = R109 000 2013/14 = R0 2014/15 = R0 3 (iv) (v) 2015/16 = R 69 000 2016/17 = R0 (2) (a) Yes, it is addressed in the ICT Policy (b) Awareness program is done every six months and constant communication sent out by both the company secretary and the ICT Manager regarding cyber security issues.
The awareness program involves the ICT Manager engaging the relevant employees at certain forums and discusses issues around cyber security.

The topics cover the following areas: (i) What is Malware (malicious software), how does Malware work, how does Malware get into my pc, why is Malware used?

What is Spyware, how does Spyware work, how does Spyware get into my pc, why is Spyware used?

What is Phishing, how does Phishing work, how does a Phishing attempt reach me, why is Phishing used?
What is Spam, how does Spam work, how does Spam get into my pc, why is Spam used?

What is Adware, how does Adware work, how does Adware get into my pc, why is Adware used?

(ii) (iii) (iv) (v) (3) No professional assistance required except for a yearly audit and the Sonicwall device that was procured to prevent attacks.

(4)  We make use of a company called Datategra to provide us with external help on cyber security matters.
We are also protected by T- systems through their Palo Alto and checkpoint security solutions.

 We have the website files backed up locally and externally (on the cloud) and the external servers are running Linux with 245bit encryption.

The recent issues have been windows vulnerabilities.
 The mine emails are backed-up in a data centre in Cape Town and the head office emails are backed internally on the server and the server itself is backed-up by an external service provider and the environment of the external service provider is as follows:  The email environment is hosted at a local data centre in Isando.

The data centre provides un-interrupted power, biometric access control and fire suppression.
 The servers that our email service is hosted on is protected by firewalls and anti-virus software.

This is constantly monitored and kept up to 4 date.

 Our email services are also replicated to a secondary data local centre so that in the event of a failure at the primary site, we are able to provide service continuity by utilising the secondary data centre.

 As a result of having such a large environment, we experience constant attempted threats however your email has never been breached.
 Every email account on our platform includes anti-spam software that filters and quarantines the majority of the spam email.

 Our engineering team that monitors and maintains the platforms undergo continual training through Microsoft and other major suppliers to combat potential threats  We do not employ a permanent cyber security expert however all engineers undergo constant training to prevent cyber-attacks.
(5) (a) (b) (c) (d) (e) 2012/13 No attacks 2013/14 No attacks 2014/15 No attacks 2015/16 No attacks 2016/17 No attacks (i) (ii) Not applicable Not applicable DENEL SOC LIMITED (1) (a) (b) (i) (ii) (iii) (iv) (v) (i) (ii) (iii) (iv) (v) 2012/13 = R 5 000 000 2013/14 = R13 000 000 2014/15 = R 3 000 000 2015/16 = R 4 700 000 2016/17 = R 6 000 000 2012/13 = R 5 000 000 2013/14 = R13 000 000 2014/15 = R 3 000 000 2015/16 = R 4 700 000 2016/17 = R 6 000 000 (2) (a) (b) Yes Yes, there are a number of internal campaigns including the 5 following:  Simulated phishing attacks using software  On-going communication campaigns  Classroom based training and animation scenarios (3) (4) (5) There are engagements with cyber security experts as required, with penetration, vulnerability testing and independent (external) audits.
This cyber security role is currently fulfilled by the Chief Information Officer in each Denel division.

(a) (b) (c) (d) (e) 2012/13 - No 2013/14 - No 2014/15 - Isolated minor incidents of virus infection and phishing 2015/16 - No 2016/17 - No (i) R200 000 for 2014/15 (virus infection and phishing scam) (ii) The risks associated with cyber-attacks are typically loss of data, unauthorised data access and production down time.

None of these risks materialised as a result of cyber-attacks.
ESKOM SOC LTD (1)(a) Eskom spent a total of R 367 million on the prevention of cyber-attacks.
Period 2012/13 2013/14 2014/15 2015/16 2016/17 R’m R 23.9 million R 54.2 million R 57.8 million R 120.1 million R 110.9 million (1)(b) Eskom invested a total of R174.3 million into cyber security over five years as per table below: Period 2012/13 R’m R 80.4 million 6 2013/14 2014/15 2015/16 2016/17 R 12.3 million R 7.6 million R 26,4 million R 47.6 million The increase in investment seen since financial year 2012/2013 and 2016/2017 is attributed to an increased impetus and the establishment of a security programme with the aim of maturing operations; in addition, human resources and assets were insourced from the IT Service provider (T-systems).
(2)(a) Yes, Eskom has had an Information Security Policy (number 32-85) for a number of years.

The policy addresses the aspects of the NIST cybersecurity framework which has been adopted by Eskom.

The policy is currently under review to incorporate Eskom’s IT strategic direction.

Eskom also has an OT cyber security standard.

(2)(b) Yes, Eskom conducts various awareness initiatives for information and cyber security.
Each financial year, Eskom develops an information security awareness plan that sets the tone for awareness in Eskom.

The plan details the awareness themes, the month and the manner in which the awareness campaign will be conducted.

Awareness is conducted through e-mail communications, walkthroughs, new employee induction and face-to-face presentations to Eskom employees to create awareness.

In addition, adhoc awareness is conducted when cyber threats or incidents arise (e.g Wannacry ransomware alert).
Eskom has also developed a two (2) day Cyber security fundamentals training currently being rolled out to the organisation.

This training has been CPD accredited by SAIEE.

(3) Eskom has contractual agreements with a number of service providers for technologies in use against cyber-attacks.

These contracts are to support, maintain and mature these technologies.

7 Furthermore, Eskom has a bilateral agreement with CSIR.
This Memorandum of agreement (MOA) is in execution to see amongst other deliverables cyber security research and technologies being implemented in Eskom.

(4) Eskom had previously made use of a contracted cyber security expert in the year 2012-2015.

This contract was not renewed due to restructuring of the Information Security function that was underway after the insourcing of core security services from a service provider (T-Systems).

This service is on the plan for the next quarter (July-Sept 2017).
(5)(a) None (5)(b)(i) A denial of service (DOS) attack was carried out on Eskom on the proxy infrastructure.

The proxy infrastructure was put in quarantine and the vulnerability remediated.

Eskom employees could not access the internet for 24 hours during the remediation.

An existing contract together with internal resources was used at no extra costs as some applications did not necessarily require internet.
(5)(c) None (5)(d) During 2015/16, there was a cyber-crime attempt to steal +- R3 billion from Eskom financial infrastructure, the incident was handled internally by Eskom security and handed over to SAPS for further processing.
(5)(e) None SAFCOL SOC LIMITED (1) (a) (i) (ii) (iii) (iv) (v) 2012/13 = R NIL 2013/14 = R NIL 2014/15 = R NIL 2015/16 = R 120 000 2016/17 = R 605 750 8 (b) (i) (ii) (iii) (iv) (v) 2012/13 = R NIL 2013/14 = R NIL 2014/15 = R NIL 2015/16 = R 120 000 2016/17 = R 605 750 (2) (a) (b) Yes SAFCOL has in place an information security policy and information security awareness sessions are held with employees, users and administrators regularly.
(3) (4) (5) SAFCOL sought professional assistance for network security reviews in the 2015/16 financial year.

In the 2016/17 financial year SAFCOL sought professional assistance for an implementation of new firewalls and related technology as part of enhancing perimeter security.
For the 2017/18 financial year, SAFCOL intends engaging service providers to conduct the following:  penetration tests  vulnerability assessments  cyber security consulting (managed security service) No permanent cyber security expert with the aim to prevent cyber- attacks is currently employed by SAFCOL.

However, this service is and will continue to be outsourced to a specialist service provider.
(a) (b) (c) (d) (e) 2012/13 - No 2013/14 - No 2014/15 - No 2015/16 - No 2016/17 - No (i) (ii) None None SAX SOC LTD (1) South African Express has never had a direct spending on cyber security.

The spending is on ICT security in a form of Anti-virus Software and Firewalls.

9 (2)(a) Yes, South African Express has recently updated its Internet and Email Usage Policy and User Account Management Policy.
(b) Once the policies are approved by the ARC and Board there are planned awareness sessions to be held for the employees.

(3) No professional assistance has been required.

The Chief Information Officer has been appointed at an executive level to manage ICT risks.

(4) South African Express does not have a permanent cyber security expert in the structure.
This is mainly because of the costs involved in appointing such an expert permanently vs the probability of the risk, SA Express’s core systems are hosted by and maintained by SAA.

(5) SA Express has never been exposed to cyber security attacks before.

TRANSNET SOC LTD (1)(a) (b (i) Transnet spent R10, 3m from FY2015-present on prevention of cyber-attacks.
No direct investment was made (ii) No direct investment was made (iii) R71m (iv) R1, 1m (v) R1, 5m (2)(a) Transnet has an Information Security Policy (b)Transnet has an Annual Cyber security program that started 3 years ago, which requires employees to participate.

ICT security also send out monthly cyber security emails notifications to all employee to keep abreast on the latest developments.
(3) Transnet is in the process of engaging potential service provider independent Cyber Security Assessment exercise that will inform the ICT Cyber Security Roadmap.

to conduct an 10 (4) Transnet ICT is currently evaluating the process to appoint a permanent Cyber Security expert.

(5) (a) During the FY2012/13 a cyber-related incident was reported (i) (ii) Following an investigation, there was no evidence of any data or information leakage.
Transnet subsequently had to budget for prevention of such incidents.

to New Generation Firewalls were deployed increase monitoring of the environment and regular scanning and updating of software vulnerabilities.

in order Mogokare Richard Seleke Lynne Brown, MP Director-General Minister of Public Enterprises Date: Date: 11